If your users jump through proxies and load balancers before accessing to your web application, the IP field in IIS logs may show the IP address of a network device instead of client’s IP address. In...
Updated Sep 25, 2019
Version 4.0
Blog Post
Thank you, really appreciate the article. Just what I was looking for.
Only problem I have now is that logparser cannot read the log with the additional field added... but that is a logparser problem
Correction.
... Scrap that comment.... just found selecting Log type as W3CLOG instead of IISW3CLOG works. 🙂